Skip to content

Detector catalog

interlock ships 105 detectors. Each one is a small, dependency-free rule for a single kind of attack. Nothing is enabled until you install it. To learn how to choose and combine them, read the detectors guide.

How to read the table:

  • Factory is what you call to build the rule, e.g. from interlock.detectors.sql_injection_guard import sql_injection_guard. =… marks an optional parameter.
  • Verdict is what the rule returns on a match: block stops the call, rewrite lets it continue with the matched text masked or the event stamped.
  • Scoped to is which events the rule looks at. A detector scoped to named actions does nothing for a tool with a different name, so check this column before you rely on one. "any call" means every call-phase event.

Categories

Prompt injection and jailbreaks

Hostile instructions in user input, retrieved documents, tool output, or agent memory.

Detector What it catches Verdict Scoped to Factory
prompt_injection Indirect prompt-injection input detector. block any call prompt_injection_detector(content_keys=…, extra_patterns=…)
jailbreak Jailbreak / refusal-bypass input detector. block any call jailbreak_detector(extra_patterns=…)
dan_persona_guard DAN / AIM / STAN persona-jailbreak detector. block any call dan_persona_guard(extra_patterns=…)
crescendo_guard Crescendo gradual-escalation jailbreak detector. block any call crescendo_guard(extra_patterns=…)
many_shot_jailbreak_guard Many-shot jailbreak framing signature for input actions. block any call many_shot_jailbreak_guard(extra_patterns=…)
leetspeak_jailbreak_guard Leetspeak / obfuscated jailbreak-term detector. block any call leetspeak_jailbreak_guard()
hypothetical_framing_guard Hypothetical / fiction-framing jailbreak signature for input actions. block any call hypothetical_framing_guard(extra_patterns=…)
social_engineering_framing_guard Social-engineering framing jailbreak signature for input actions. block any call social_engineering_framing_guard(extra_patterns=…)
refusal_suppression_guard Refusal-suppression jailbreak detector. block any call refusal_suppression_guard(extra_patterns=…)
goal_hijack_guard Goal-hijacking phrase signature for input actions. block any call goal_hijack_guard(extra_patterns=…)
system_prompt_extraction System-prompt extraction attempt detector. block any call system_prompt_extraction(extra_patterns=…)
indirect_injection_marker Indirect prompt-injection marker for retrieved / tool-returned content. block any call indirect_injection_marker(extra_patterns=…)
translation_evasion_guard Translate-then-execute evasion detector. block any call translation_evasion_guard(extra_patterns=…)
delimiter_smuggling Fake chat-delimiter smuggling detector (ChatML / instruction tags). block any call delimiter_smuggling()
homoglyph_injection Homoglyph-normalized jailbreak scan. block any call homoglyph_injection(extra_patterns=…)
unicode_tag_injection Unicode tag / invisible-character instruction smuggling detector. block any call unicode_tag_injection()
html_comment_injection_guard Hidden HTML-comment instruction guard. block any call html_comment_injection_guard()
markdown_link_injection_guard Block injected instructions hidden in markdown link text. block any call markdown_link_injection_guard()
payload_splitting_guard Payload-splitting / assembly-instruction detector. block any call payload_splitting_guard(extra_patterns=…)
base64_payload_scan Base64 / hex encoded-injection detector. block any call base64_payload_scan()
canary_leak_guard Canary-token leak guard: block egress that carries a planted canary. block fetch, http_post, log, request, send, upload canary_leak_guard(canaries)
pinned_context_guard Pinned-context overwrite guard: memory writes must not clobber load-bearing keys. block context_set, memory_write, set_state pinned_context_guard(protected)
memory_write_injection_guard Agent-memory write injection guard. block any call memory_write_injection_guard(extra_patterns=…)
tool_output_override_guard Instruction-override phrases smuggled inside tool OUTPUT. block any call tool_output_override_guard(extra_patterns=…)
tool_result_injection_guard Indirect prompt injection smuggled inside a tool RESULT. block tool results tool_result_injection_guard(extra_patterns=…)
rag_source_allowlist Retrieval guard: only retrieve documents from allowlisted sources. block rag_query, retrieve, search_docs rag_source_allowlist(allowed)
mcp_prompt_arg_injection MCP prompt-template argument-injection detector. block any call mcp_prompt_arg_injection(extra_patterns=…)

Classic injection in arguments

Web-era vulnerabilities that ride in a tool argument the model filled in.

Detector What it catches Verdict Scoped to Factory
sql_injection_guard Block query arguments carrying classic SQL-injection shapes. block any call sql_injection_guard()
nosql_injection_guard Block NoSQL operator injection smuggled into tool arguments. block any call nosql_injection_guard()
shell_injection_guard Block command arguments that carry shell metacharacters. block any call shell_injection_guard()
ldap_injection_guard Block LDAP filter injection smuggled into tool arguments. block any call ldap_injection_guard()
xxe_guard Block XML external-entity (XXE) declarations in tool arguments. block any call xxe_guard()
ssti_guard Block server-side template-injection (SSTI) syntax. block any call ssti_guard()
path_traversal_guard Block file-tool arguments that escape their directory. block any call path_traversal_guard()
prototype_pollution_guard Block prototype-pollution keys smuggled in tool arguments. block any call prototype_pollution_guard()
open_redirect_guard Open-redirect parameter guard. block any call open_redirect_guard()
crlf_header_injection_guard CRLF header/log-injection guard. block any call crlf_header_injection_guard()
script_tag_output_guard HTML script-tag / inline-handler output guard (stored XSS). block any call script_tag_output_guard()
ansi_escape_output_guard Block ANSI-escape sequences in output-bound text. block any call ansi_escape_output_guard()
url_scheme_guard Egress scheme allowlist: only http(s) destinations may be sent to. block fetch, http_get, http_post, request, send, upload url_scheme_guard()
mass_assignment_guard Block mass-assignment of privilege-bearing fields. block any call mass_assignment_guard()
pickle_deser_guard Block code that reaches an unsafe deserialization entry point. block any call pickle_deser_guard()
download_extension_guard Block download/write targets that carry an executable extension. block any call download_extension_guard()

Secrets and personal data

Mask credentials and PII out of outbound payloads (most rewrite rather than block).

Detector What it catches Verdict Scoped to Factory
bearer_token_redactor Authorization Bearer token redaction: strip the credential, keep the send. rewrite fetch, http_get, http_post, log, request, send, upload, write bearer_token_redactor()
basic_auth_url_redactor Basic-auth-in-URL credential redaction: mask user:pass@ out of egress text. rewrite fetch, http_get, http_post, log, request, send, upload, write basic_auth_url_redactor()
aws_arn_redactor AWS ARN redaction: strip resource ARNs out of egress payloads, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write aws_arn_redactor()
github_pat_redactor GitHub token redaction: strip personal/OAuth access tokens out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write github_pat_redactor()
google_api_key_redactor Google API key redaction: mask keys out of egress payloads, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write google_api_key_redactor()
jwt_redactor JWT redaction guard: strip bearer tokens out of egress payloads, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write jwt_redactor()
pem_private_key_redactor PEM private-key redaction: strip private-key blocks out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write pem_private_key_redactor()
db_uri_redactor Database-URI credential redaction: strip user:pass out of egress payloads. rewrite fetch, http_get, http_post, log, request, send, upload, write db_uri_redactor()
stripe_key_redactor Stripe secret key redaction: mask keys out of egress payloads, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write stripe_key_redactor()
slack_webhook_redactor Slack webhook redaction guard: mask webhook URLs out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write slack_webhook_redactor()
s3_presigned_redactor S3 presigned-URL signature redaction: strip the capability, keep the send. rewrite fetch, http_get, http_post, log, request, send, upload, write s3_presigned_redactor()
output_secret_redactor Output secret redaction: mask vendor keys out of tool RESULTS, don't block. rewrite http_post, log, output, respond, return, tool_result output_secret_redactor()
secret_entropy_egress_guard High-entropy token egress guard: block outbound payloads carrying likely secrets. block fetch, http_post, request, send, upload secret_entropy_egress_guard(min_len=…, threshold=…)
env_secret_read_guard Block reads of secret-bearing environment variables. block any call env_secret_read_guard()
git_credential_guard Block reads of git credential stores. block any call git_credential_guard()
email_pii_redactor Email address redaction guard: mask addresses out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write email_pii_redactor()
output_email_redactor Generated-output email redaction: mask addresses out of egress, don't block. rewrite http_post, output, respond, return, tool_result output_email_redactor()
iban_redactor IBAN redaction guard: mask bank account numbers out of egress payloads. rewrite fetch, http_get, http_post, log, request, send, upload, write iban_redactor()
ssn_redactor US Social Security Number redaction guard: mask SSNs out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write ssn_redactor()
us_phone_redactor US/E.164 phone redaction guard: mask phone numbers out of egress payloads. rewrite fetch, http_get, http_post, log, request, send, upload, write us_phone_redactor()
ipv4_redactor Private IPv4 redaction guard: mask internal addresses out of egress, don't block. rewrite fetch, http_get, http_post, log, request, send, upload, write ipv4_redactor()

Data leaving the system

Where data may go and how much of it, before it leaves the process.

Detector What it catches Verdict Scoped to Factory
data_egress Data-domain guards: stop the agent from moving data where it should not. block, rewrite egress verbs (http_post, fetch, send_email, +16 more); sensitive_path_guard: read verbs (read_file, cat, open, +8 more). Configurable network_egress_guard(allowed_hosts, egress_actions=…, destination_keys=…, reason=…)
pii_redaction_guard(actions=…, content_keys=…, patterns=…, marker=…, reason=…)
sensitive_path_guard(sensitive_paths=…, read_actions=…, path_keys=…, reason=…)
egress_rate_limiter Per-principal egress rate limiter: cap outbound calls per principal. block fetch, http_post, send, upload egress_rate_limiter(limit=…)
private_ip_egress_guard SSRF guard: block egress to private / loopback / link-local addresses. block fetch, http_get, http_post, request, send, upload private_ip_egress_guard()
raw_ip_egress_guard DNS-rebinding guard: block egress whose destination is a bare IP literal. block fetch, http_get, http_post, request, send, upload raw_ip_egress_guard()
data_volume_egress_guard Bulk-exfiltration guard: block egress payloads that exceed a byte budget. block fetch, http_post, request, send, upload data_volume_egress_guard(max_bytes=…)
markdown_image_exfil_guard Block zero-click markdown-image exfiltration. block any call markdown_image_exfil_guard()
host_fanout_guard Egress host fan-out guard: block an agent that contacts too many distinct hosts. block fetch, http_get, http_post, request, send host_fanout_guard(limit=…)

Code execution and host access

Commands and submitted code that would reach the shell, filesystem, or network.

Detector What it catches Verdict Scoped to Factory
execution_guard Dangerous-execution interceptor. block bash, eval, exec, run_code, shell, spawn, subprocess, system. Configurable execution_guard(execution_actions=…, extra_patterns=…)
code_eval_exec_guard Block submitted code that calls a dynamic-execution builtin. block any call code_eval_exec_guard()
code_dunder_escape_guard Block code arguments that walk the Python object graph. block any call code_dunder_escape_guard()
code_filesystem_guard Block submitted code that reaches the filesystem. block any call code_filesystem_guard()
code_network_guard Block sandboxed code that reaches for the network. block any call code_network_guard()
dynamic_import_guard Block a string argument reaching a blocked module via dynamic import. block any call dynamic_import_guard()
subprocess_spawn_guard Block code that spawns a subprocess. block any call subprocess_spawn_guard()
destructive_command_guard Block irreversible destructive shell commands. block any call destructive_command_guard()
sensitive_file_write_guard Block writes aimed at credential or system config paths. block any call sensitive_file_write_guard()
signal_kill_guard Block code that signals or forks out of the sandbox. block any call signal_kill_guard()
memory_bomb_guard Block allocation bombs before they exhaust memory. block any call memory_bomb_guard()

MCP servers and tools

Which servers an agent may connect to, and whether their tools changed since review.

Detector What it catches Verdict Scoped to Factory
mcp_server_allowlist MCP server URI allowlist: block session connects to unvetted servers. block mcp.connect mcp_server_allowlist(allowed_hosts)
mcp_tool_pinning MCP tool schema pinning: freeze a tool's declared schema, block later drift. block calls to the tools you pinned; reads args["__schema__"] and blocks when it is missing mcp_tool_pinning(pins)
mcp_tool_description_scan MCP tool-description injection detector. block any call mcp_tool_description_scan(extra_patterns=…)
mcp_trust_registry MCP trust registry: gate tool calls on the trustworthiness of their origin. block every call; origin from args["__origin__"] or a dotted name (github.create_issue). An unknown origin is blocked. Unlabelled MCP protocol events are skipped mcp_trust_registry(trusted)
mcp_resource_uri_guard MCP resource-URI prefix allowlist: block resource reads outside vetted roots. block mcp.read_resource mcp_resource_uri_guard(allowed_prefixes)
mcp_sampling_model_guard MCP sampling model allowlist: pin server-initiated sampling to vetted models. block mcp.sampling mcp_sampling_model_guard(allowed_models)
mcp_consent_budget MCP high-risk tool consent budget: block past N uses in a session. block any call, counted per tool name. Wrap it so it only sees your high-risk tools mcp_consent_budget(limit=…)
mcp_capability_lease MCP capability lease: a grant that expires, enforced at call time. block calls whose server is known (__origin__ or dotted name); a lease covers one server and tool name; tools/list and unlabelled MCP protocol events are ignored mcp_capability_lease(registry)
mcp_server_attestation MCP server attestation: block a server whose identity changed under its name. block events from the servers you listed (__origin__ or dotted name); reads __attestation__ and __tools__ mcp_server_attestation(identities, verifier=…)
mcp_surface_baseline MCP tool surface baseline: a listing that changed is a new admission. block tools/list events labelled with __origin__; reads __tools__ mcp_surface_baseline(leases=…)

Budgets, rate limits, and loops

Stop runaway agents: too many calls, too much spend, the same call on repeat.

Detector What it catches Verdict Scoped to Factory
call_rate_limiter Per-principal call-rate limiter: cap how many calls one principal may make. block any call, counted per principal call_rate_limiter(limit=…)
cost_budget_guard Cumulative cost-budget guard: block once spend exceeds a running total. block calls with a numeric args["cost"] cost_budget_guard(budget=…)
tool_budget_limiter Per-tool-name call budget: cap how many times one tool may be called. block any call, counted per tool name tool_budget_limiter(limit=…)
write_action_limiter Per-principal write/mutation budget: cap state-changing actions per principal. block actions starting with write, delete, update, create write_action_limiter(limit=…)
duplicate_call_loop_guard Stuck-agent loop guard: block on identical calls repeated in a row. block any call, identical repeats in a row duplicate_call_loop_guard(limit=…)
output_length_guard Excessive-output guard: block model/tool output that exceeds a byte budget. block output, respond, return, tool_result output_length_guard(max_bytes=…)
memory_write_size_guard Oversized memory-write guard: block context writes past a byte threshold. block context_set, memory_write, remember memory_write_size_guard(max_bytes=…)
failed_auth_lockout Failed-authentication lockout: stop a principal that keeps failing to authenticate. block auth failed_auth_lockout(limit=…)

Provenance stamps

Rewrite events to carry integrity and ordering metadata for downstream storage.

Detector What it catches Verdict Scoped to Factory
event_hmac_stamp Per-event HMAC integrity stamp: sign an event's arguments. rewrite any call event_hmac_stamp(secret=…)
content_digest_stamp Per-event content digest stamp: attach a plain SHA-256 fingerprint of an event's action and arguments. rewrite any call content_digest_stamp(secret=…)
sequence_number_stamp Monotonic per-rule sequence stamp: attach a __seq__ ordinal to every event's args. rewrite any call sequence_number_stamp(secret=…)
provenance_origin_tag Provenance origin tagging: attach a computed __provenance__ field recording who did what, when,. rewrite any call provenance_origin_tag(secret=…)

Tool allow and deny lists

Least privilege by tool name.

Detector What it catches Verdict Scoped to Factory
tool_policy Tool-call capability policy: allowlist (least privilege) and its inverse. block any call tool_allowlist(allowed, reason=…)
tool_denylist(denied, reason=…)